{"id":"MAL-2026-19148","summary":"Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (0495a09022e152fe8c13b9251497c56e333b58af6e54c412bfd43ff4503be1a7)\npackage.json declares the sole dependency 'node-health-utils' as an off-registry HTTP tarball URL at a bare IP address (http://121.199.24.94/dl/health-utils-1.0.0.tgz) rather than a registry version range. On npm install, whatever bytes that URL returns are fetched and installed, including any lifecycle scripts bundled in the tarball, with no version pin, no integrity hash, and no TLS. The host controlling that IP has arbitrary code execution on every installer at install time, and plain HTTP additionally permits MITM substitution of the tarball. The shipped index.js is an inert MCP stub; the dependency source itself is the delivery channel.\n","modified":"2026-11-12T04:30:04.082744694Z","published":"2026-11-12T04:07:58Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-022641","import_time":"2026-11-12T04:13:27.145853871Z","modified_time":"2026-11-12T04:07:58Z","sha256":"0495a09022e152fe8c13b9251497c56e333b58af6e54c412bfd43ff4503be1a7","source":"amazon-inspector","versions":["1.0.0"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@rfewqa-fes/mnm-doc-mcp/v/1.0.0"}],"affected":[{"package":{"name":"@rfewqa-fes/mnm-doc-mcp","ecosystem":"npm","purl":"pkg:npm/%40rfewqa-fes/mnm-doc-mcp"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"f8ad55746cfac30b0a9401634b2728afc93e6dc20a85c511efd0ed312e466e8d","tlsh":"30e061208371447310c85e61ade61887fff30d7b144478211787111c85a9aad31fc369","path":"package.json"}],"package_integrity":[{"filename":"mnm-doc-mcp-1.0.0.tgz","hashes":{"sha1":"f3ad664b487c4041e7e66e5744656ed44e1a6f6a","sha512_sri":"sha512-zg8s9JoxAnma07WRjW0GN3m+tcI7HsSpbGlNNSledcxdKVlErm3SftNRtObx2bcWFLeprndUwG5fpzoSmalsUg=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@rfewqa-fes/mnm-doc-mcp/MAL-2026-19148.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}